gumblar.cn virus Please help

Discussion in 'Programming' started by nikes, Jun 3, 2009.

  1. #1
    My html and ASP.net sites are attached by gumblar.cn virus. The main problem is that GOOGLE listed my site as an attacking site and also mozilla refused to load my site.Each page in the site have a java script code added by this virus. How will I solve this problem.
     
    nikes, Jun 3, 2009 IP
  2. MossoCloud

    MossoCloud Banned

    Messages:
    60
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #2
    Pay someone at the buy sell service section to solve the problem for you.
     
    MossoCloud, Jun 3, 2009 IP
  3. WebtoolMaster

    WebtoolMaster Active Member

    Messages:
    365
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    53
    #3
    Hello,

    SQL-Infect Expoit, I think. Fix or update your scripts and check chmods.

    Remove and fix all html sites, so in some weeks google remove them.
     
    WebtoolMaster, Jun 4, 2009 IP
  4. cormack2009

    cormack2009 Peon

    Messages:
    177
    Likes Received:
    3
    Best Answers:
    1
    Trophy Points:
    0
    #4
    I found this:

    Most likely this exploit is caused by compromised FTP credentials. So start with your own computer. Scan it for spyware. Some people reported good results with Malwarebytes.

    Then (from a clean computer) change FTP passwords.

    Try not to store them inside programs that you use to upload files to a server.

    Whenever possible use secure connections. I.e. use SFTP instead of plain FTP. Many shared hosting plans include SFTP.

    Finally, remove the malicious code from all server files (.html, .php, .js, etc.). The easiest way to do it, is replace them with clean files from a backup.


    ------------

    So, unisntall FTP uploaders on your PC, install new ones and change the FTP access to your site.
    Upload again the original web pages to your site.
     
    cormack2009, Jun 4, 2009 IP
  5. aaramire

    aaramire Peon

    Messages:
    188
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    It's a pain, I was hit with this virus as well =/

    what cormack said is pretty spot on. You need to scan your computer using avast or malwarebytes use sftp instead of ftp,
    don't store passwords on your computer (text files included)

    I also read somewhere that some contact forms are vulnerable and can be a source of entry. If possible secure these or remove them

    your going to have to remove the malicious script from all infected files. If possible use your back ups.

    I received a letter of deactivation from bluehost because of this. LAME.

    Hope you got it sorted out. I'm good on my end for the moment.
     
    aaramire, Apr 8, 2010 IP